CVE-2020-15706mediumCWE-362

CVE-2020-15706: medium-severity vulnerability in Ubuntu grub2 in Ubuntu

GRUB2 contains a race condition leading to a use-after-free vulnerability which can be triggered by redefining a function whilst the same function is already executing.

Published · Updated

Follow this CVE+ Monitor grub2 in Ubuntu+ Monitor grub2

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.4epss 1.0%
GRUB2 contains a race condition in grub_script_function_create() leading to a use-after-free vulnerability which can be triggered by redefining a function whilst the same function is already executing, leading to arbitrary code execution and secure boot restriction bypass. This issue affects GRUB2 version 2.04 and prior versions.
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected products
Ubuntu · grub2 in Ubuntu
Related CVEs — Ubuntu grub2 in Ubuntu

In the same product, most dangerous first.

CVE-2020-15707MEDIUMGRUB2 contained integer overflows when handling the initrd command, leading to a heap-based buffer overflow.EPSS 1.6%CVE-2020-15705MEDIUMGRUB2: avoid loading unsigned kernels when GRUB is booted directly under secureboot without shimEPSS 1.4%